DHB Board Office
15 Shea Terrace
Takapuna, Auckland 0622
Private Bag 93-503, Takapuna
North Shore City 0740
Telephone: 09 486 8900
Facsimile: 09 486 8924
www.waitematadhb.govt.nz
29 June 2020
Amy S Van Wey Lovatt
[FYI request #12922 email]
Dear Amy
Re: OIA request – Instances of impersonation and unauthorised access
Thank you for your Official Information Act request which was partially transferred by the
Ministry of Health (MoH) to Waitematā District Health Board (DHB) on 12 June seeking
information about instances of impersonation and unauthorised access.
Before responding to your specific questions, it may be useful to provide some context about
our services.
Waitematā DHB serves a population of more than 630,000 across the North Shore, Waitakere
and Rodney areas, the largest and one of the most rapidly growing DHBs in the country. We are
the largest employer in the district, employing around 7,500 people across more than 80
locations.
In addition to providing services to our own population, we are also the metropolitan Auckland
provider of forensic psychiatry, child disability services, child community dental services and
community alcohol and drug services.
In response to your request, we are able to provide the fol owing information:
1. Please describe the best practice for a DHB to document any unlawful acts, such as acts
which are consistent with crimes under the Crimes Act, or incidents, which have the potential
to cause harm to a patient or DHB employee i.e., internal reports, eye-witness sworn
statements, CCTV footage, etc.
The MoH will respond to this aspect of your request.
2. To which agency or agencies must DHB’s report unlawful acts, such as acts which are
consistent with crimes under the Crimes Act, which are committed by either DHB employees,
members of the DHB governance, or members of the public.
The MoH will respond to this aspect of your request.
3. To which agency or agencies must DHB’s report incidents, which have the potential to
cause harm to a patient or DHB employee.
The MoH will respond to this aspect of your request.
4. Impersonation of a physician is fraud, and thus a crime. Further, the impersonation of a
physician in a medical setting would be consistent with an incident which has the potential to
cause harm to a patient. I request, for each DHB, the total number of incidents involving an
al egation that a member of the public had impersonated a physician, between 1 May 2019
and 31 August 2019, and in the event there were such incidents reported, the date of the
al eged incident, the names of the agencies the incidents were reported to and a description
of the evidence provided to support the al egation of the incident.
Any such al egations would initially be reported to our Human Resources (HR) department.
There have been no al egations of impersonation of a physician reported to HR between May
2019 and August 2019.
5. Unauthorised access, by a patient, to secure and restricted areas which require employee
key-card access, such as surgical theatres and pathology laboratories, where diagnostic and
bio-hazardous material are kept, would be an incident which has the potential to cause harm
to a patient or DHB employee. Such an incident has the potential to be a crime, if it involved
breaking and entering or theft of an employee key-card. I request, for each DHB, the total
number of incidents involving an al egation that a member of the public had gained
unauthorised access to a surgical theatre or pathology laboratory, between 1 May 2019 and
13 August 2019, and in the event there were such incidents reported, the date of the al eged
incident, the names of the agencies the incidents were reported to, and a description of the
evidence provided to support the al egation of the incident.
There are no recorded incidents between the specified dates of a member of the public
obtaining unauthorised access to either theatres or pathology labs.
6. According to the MoH standards and legal precedent, patients’ medical records are
confidential and access is restricted to the purpose in which they were obtained (for the care
and treatment of the patient) and may only be accessed with the patients consent. Please
refer to HISO 10064 and the Health Information Privacy Code 1994]. MoH standards (HISO
10029:2015 Health Information Security Framework) requires DHB’s to take steps to protect
against re-routing or interception of private (email) communications, as the interception of
private communications is a crime under section 216B of the Crimes Act. I request, for each
DHB, the total number of incidents involving an al egation that a DHB employee had engaged
in the interception of private email communications between a patient and a DHB employee,
between 1 January 2019 and 29 May 2020, and in the event there were such incidents
reported, the dates of the incidents, the names of the agencies the incidents were reported
to, a description of the evidence provided to support the al egation of the incident, and the
outcome of the investigation into the incidents (e.g., District or High Court Case Number,
Privacy Commissioner ruling, Ombudsman decision, Human Rights Tribunal ruling, etc.).
There have been no incidents at Waitematā DHB involving al egations that a DHB employee has
intercepted private email communications between a patient and a DHB employee, between 1
January 2019 and 29 May 2020, and therefore no incidents have been reported to, or
investigated by, any of the agencies you specify.
I trust that this information is helpful.
Waitematā DHB supports the open disclosure of information to assist community
understanding of how we are delivering publicly funded healthcare. This includes the proactive
publication of anonymised Official Information Act responses on our website from 10 working
days after they have been released.
2
If you consider there are good reasons why this response should not be made publicly
available, we will be happy to consider your views.
Yours sincerely,
Dr Jonathan Christiansen
Chief Medical Officer
Waitematā District Health Board
3
